Genealogy site put users at ‘obvious’ risk of identity theft

July 22, 2014

The site may have only launched its civil records search facility on July 3, but it was shut down on Friday over fears that people’s personal data could be exploited.

A note on the website now reads: “Civil Records Search [is] temporarily unavailable … Further update will be provided.”
The move came after an order by Ireland’s Data Protection commissioner to close its civil records search element, warning that the fact that it contained live data exposed potentially sensitive details to anyone that chose to browse the site, www.irishgenealogy.ie, and take advantage of them.

Irish Genealogy, created by the Department of Arts, Heritage and the Gaeltacht, was set up to provide people who were born or married in Ireland the possibility of looking for civil records like birth and marriage certificates, as part of research into their family history.

However, the problem is that within those records are details like people’s dates of birth, mothers’ maiden names and other information which is frequently used for accounts such as online banking and personal emails.

Under Ireland’s current data protection law, these details are not legally defined as “sensitive”, but the Data Protection commission deemed them sensitive enough to block them from the site.

Billy Hawkes, the Irish data protection commissioner said he was shocked that information available would be on current users, as well as their ancestors. He had, he said, been consulted on the site but this element – of publishing living users’ details – had not been made clear.

Before the existence of online civil records, the information that the genealogy website ran had always been available to any member of the public that asked for it, but it incurred a fee in order to receive a copy of that specific record.

Since the civil records went online, that service became free and thus, the risk of the information falling into the wrong hands and being misused increased.

Hawkes said that having citizens’ details freely available online was a ‘shocking’ example of public service failure, adding that the risks involved in the site – including the potential for identity theft – were “obvious”.

Asked if the records in their current form would be made available online in future, Mr Hawkes said they would not. “In context, a lot of the stuff on the site is harmless – it’s about dead people. Which is what you would expect for genealogy”, he told the Irish Times.

But he said it seems someone “missed the plot” by putting live information on it, and praised the person that drew attention to the mistake, saying they had done “a very important public service” before it became “a treasure trove for people of evil intent”.

Mr Hawkes said he could only hope not many people had been aware of the issue, as you don’t normally associate a genealogy site with active data, but rather with late ancestors.

Upon its launch in March 2013, the search portal focused on historical records, allowing users to search things like the 1901 and 1911 censuses, Griffiths Valuations (the first full scale valuation of 19th Century property in Ireland, published 1847 to 1864), military archives and Ellis Island records, passenger lists and other records of U.S. immigration through Ellis Island, New York.